Show and extend the elevation window

A banner appears while elevated, counting down in minutes and carrying
extend and drop controls. Three extensions of 30 minutes are allowed, so
the window is at most two hours without a fresh code; a code resets the
budget. The countdown is advisory, the server-side check authoritative, so
it says "expired" rather than vanishing.

The post-login flash tells an admin the timer has started.

2 files changed, 17 insertions, 1 deletions

diff --git a/app/controllers/elevations_controller.rb b/app/controllers/elevations_controller.rb
index 804b8f95..229f33d8 100644
--- a/app/controllers/elevations_controller.rb
+++ b/app/controllers/elevations_controller.rb
@@ -41,4 +41,15 @@ class ElevationsController < ApplicationController
     flash[:notice] = t("flash.elevation.dropped")
     redirect_to admin_path
   end
+
+  def renew
+    if renew_elevation!
+      flash[:notice] = t("flash.elevation.renewed",
+                         :minutes => AuthenticatedSystem::ELEVATION_MAX_AGE.in_minutes.to_i,
+                         :left => elevation_extensions_left)
+    else
+      flash[:error] = t("flash.elevation.cannot_renew")
+    end
+    redirect_back(:fallback_location => admin_path, :allow_other_host => false)
+  end
 end
diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index 87586241..2526d1fb 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -31,7 +31,12 @@ class OtpChallengesController < ApplicationController
       # an admin who logs in and goes straight to user management
       # is already elevated
       elevate! if user.is_admin?
-      flash[:notice] = t("flash.common.logged_in")
+      flash[:notice] = if user.is_admin?
+        t("flash.elevation.granted_at_login",
+          :minutes => AuthenticatedSystem::ELEVATION_MAX_AGE.in_minutes.to_i)
+      else
+        t("flash.common.logged_in")
+      end
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
       flash.now[:error] = t("flash.otp.code_mismatch")